Free Britney Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Free Britney (FreeBritney) is a BEP20 token on BNB Smart Chain whose _approve function was rewritten so that only one hardcoded address, 0x9a22E092…604b1e (the deployer address), can store a real allowance. For every other holder _approve stores 0 and emits an Approval event reporting the value 4, so an approval that looks successful grants nothing. A router sells by pulling tokens with transferFrom, and transferFrom subtracts the amount from that zero allowance, so the sell reverts; plain transfer calls have no such restriction.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot with no loss figure and describes the owner as able to disable transfers; the verified source has no on/off switch for transfers, and the restriction is the allowance rule described above.

How it happened

  1. The constructor sets _totalSupply = 10000000000000 (decimals 5, so 100,000,000 tokens) and credits all of it to msg.sender, the deployer 0x9a22E092…604b1e.
  2. _approve is changed to branch on a hardcoded address: if (owner == address(0x9a22E092FFff1ab3380d8cf8386eD47Ecd604b1e)) { _allowances[owner][spender] = amount; for that address, and _allowances[owner][spender] = 0; emit Approval(owner, spender, 4); for everyone else.
  3. A holder who calls approve(router, amount) runs this _approve: the stored allowance stays 0 while the emitted event shows 4. transfer is not gated, so wallet-to-wallet moves and tokens leaving a pool to a buyer still work.
  4. A sell through a router calls transferFrom(holder, pool, amount). After _transfer the function runs _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). The allowance is 0, so sub reverts for any amount above 0 and the whole sell is undone; the holder's balance is not debited.
  5. The hardcoded address is exempt, so the code allows only that address to approve a router and sell through transferFrom. Because the address is written into _approve rather than read from the owner variable, renounceOwnership does not remove the restriction; the owner-only mint(uint256 amount) is separate. A read of owner() on 2026-09-30 returned the zero address; no source opened here shows when ownership was renounced.
  6. What happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-07-05. No sale attempt, transaction or loss figure was verified.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract FreeBritney

Evidence

Same attack technique

Browse all hacks →
BNB Chain AnimalHouse Finance Loss not disclosed BNB Chain Pera Finance Loss not disclosed BNB Chain TRUMP 2024 Loss not disclosed BNB Chain MoonPilot Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes